alert Epik Had A Major Breach

[DaveX]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[dirk]

Real safe haven...have you checked the dox on twitter? He exposed all of these people (Thank you God / Allah / Yahweh).

Yeah, obviously it doesn't work out the way they handle things ATM. I mean, drop politics, domainers, making the world a better place and concentrate on the core business. Facilitating domain registrations. Don't draw attention, just deliver a superb user experience. Ignore any media attention. That's the way to go. Imo. If... You want to continue to cater a certain niche.

 

[.X.]

imo ... freedom of speech can affect everyone’s right to freedom of expression. It's complicated - whoever runs the freedom of speech brainstorm should come with a few more ideas...

it is very complicated in this day and time .. I support 1A as much as anyone … yet at the same time .. I do not support such sites that promote hate speech .. Harm and the likes of .. I can not support hate and harm .. no matter my political affiliation or whatever the case may be

 

[.X.]

Real safe haven...have you checked the dox on twitter? He exposed all of these people (Thank you God / Allah / Yahweh).

but just some dialogue between you and I .. if it were your letter .. and you ended it with whom ever you believe in or whatever the case may be that you chose to end your letter in … should I be offended or insulted ?? It’s your letter you composed

 

[labrocca]

Sadly it's okay in this day to attack people for their views. Especially if those views are pro-religion or pro-conservative. Almost everyone else gets a pass to say the craziest stuff imaginable. The Right are being publicly persecuted. Rob does believe it's part of his mission to fight back. Maybe that's not a great way to run a business but I think people should respect his beliefs. I don't think he should be attacked for having convicton. If you don't want to use Epik, then don't.

I have domains at Epik. I have no actual personal data exposed. I pay with crypto. I use a voip phone number. My address is already public. But for now I have logged in and changed my credentials.

 

[mr-x]

Yeah, tried to watch it earlier but it made me cringe so much. I seriously feel for Rob. He's not a bad guy but there's no reasoning with the lowlifes in that chat.

No matter what side you're on, when you go dark, you join the lowlife club imo.

He should have listened to his lawyers.

 

[johnn]

The news is too big on the Internet so I think they (Epik) will be down for years to come. Some said "I will keep using them" but you need to realize that the buyers will not like the names to be with them. They don't care if you like them or not.
With all the bad information: plain text data, old and out of date software, cheap and unqualified employees - I am not sure how long they will survive.
The big problem now is for members who have hundred or thousand names with them it's not easy to transfer them out as they cost too much.
Rule #1 in IT - Don't hand your security matters to the ones that you don't know well.

 

[DaveX]

Just now, on another platform, someone has reported that they have been emailed their own credit card number. Actually both their own credit card number and their partners credit card number..

 

[Dondomainer]

The news is too big on the Internet so I think they (Epik) will be down for years to come. Some said "I will keep using them" but you need to realize that the buyers will not like the names to be with them. They don't care if you like them or not.
With all the bad information: plain text data, old and out of date software, cheap and unqualified employees - I am not sure how long they will survive.
The big problem now is for members who have hundred or thousand names with them it's not easy to transfer them out as they cost too much.
Rule #1 in IT - Don't hand your security matters to the ones that you don't know well.

Say that is to say a lot...

What is left, what is far right. I'm left wing, Epik is right wing.
There is a deepstate which appears as right wing (as in case of Hitler, Bush), or left wing (Obama, Biden, Clinton). There is no difference between those. I'm on Epik's side, except for religion. I'm not religious, but this doesn't mean I'm not spiritual. For example I might be interacting with ETs without being aware of it. And vaxed people might be interacting with AI grid/cloud without being aware of it.
Hitler didn't lose, he won, his daughter Angela is at the top of Germany, but his team is losing now.

If you believe that Hitler was from the right side, you have been influenced by the manipulation for the left side..

 

[DN Universal]

Just now, on another platform, someone has reported that they have been emailed their own credit card number. Actually both their own credit card number and their partners credit card number..

If this statement is true, then there is a major breach somewhere...

 

[tonyk2000]

General observations re. credit cards used on Epik. Yeah, if you used it at Epik (and/or have it stored) - cancel it. Ask your bank also to add it to "stop list" as an extra security measure (delayed or offline authorizations or charges may still be possible).

Other registrars _may_ accept something like a correct answer to "what are the last 4 digits of your CC" question as a way to verify who the customer is in case of lets say incoming phone calls - So, remove this CC from other registrars.

Switching to one time virtual cards is a good idea. If it is unavailable at your bank (or your country) - then you may switch to debit cards (would be harder to spend a lot of your $$$ in case of potential future hacks - no credit line), or to prepaid gifts cards. If virtual cards are unavailable - most banks would be happy to issue extra cards (linked to the same account), so, at least: one card for "registrar A" exclusively, another card for "drop catcher B" exclsively, etc, etc, etc. Should either be hacked - you'll have to cancel just the 1 card used with this service only. Do not maintain a large balance, just what is necessary for daily needs.

At this time, however, I'd avoid using any type of debit or credit cards with Epik (except, possibly, 1 time virtual cards).

Not only different passwords - but also different usernames, and different emails - at least for critical services you use daily. Checking a lot of webmail inboxes may not be convinient though - so, consider a pop3/imap client (but, it will decrease the security as there is no 2FA in imap and pop3). Stop using windows (any version). Mac - maybe, but as a temporary solution only. Linux workstation appears to be the best at this time. Do not try Ubuntu though (they are becoming less and less trusted/secure). The last Debian should be OK.

Sorry, too offtopic already. Maybe @Paul can start a separate sticky thread with all the relevant recommendations (and his final findings!) in light of epik breach... and move the related posts from this thread to it

 

[Shackleton]

Monster seems to be MIA from this thread. He has all the time in the world to shill crappy domains to newbies on the hyphens are awesome thread but can't grace us with his presence on this important thread.

 

[kam]

Rob does believe it's part of his mission to fight back. .

He fights too long against dragons and then becomes a dragon himself

 

[Beezy]

The password for an admin account was 123.

I posted a screen shot originally but I don't want to be accused of posting any docs.

Wildly incompetent stuff.

Dragons don't exist, kam.

 

[Paul]

NamePros observed a credential stuffing attack beginning around 7:59 PM EDT (UTC-4). On-call NamePros staff were paged around 8:01 PM EDT. I responded. I reviewed recent logins and manually flagged two as suspicious, which logged the users out and forced a password reset. The users will be notified of the reason upon resetting their passwords. The majority of the login attempts were blocked when our system detected an unusual number of failed login attempts and began captcha'ing all logins.

As a precaution, I manually enabled Cloudflare captchas for all logins instead of the usual captchas to ensure that nothing slips through the cracks. We plan to keep it enabled overnight.

At least some of the usernames attempted appear to be in the Epik breach, although that could easily be a coincidence--it's a small industry, after all. The attacker is one we've seen before, and we don't believe they have any affiliation with the Epik breach, though it's certainly possible they've added that data to their list of usernames and passwords.

The attack does not appear to have been successful. The attacker appears to have grown frustrated and attempted to register a new account when they weren't able to compromise existing accounts. The new account was flagged for review and closed.

We're still assessing the situation and trying to determine the best way to secure accounts that appear in the Epik breach. We don't have definitive plans yet.

 

[Beezy]

NamePros observed a credential stuffing attack beginning around 7:59 PM EDT (UTC-4). On-call NamePros staff were paged around 8:01 PM EDT. I responded. I reviewed recent logins and manually flagged two as suspicious, which logged the users out and forced a password reset. The users will be notified of the reason upon resetting their passwords. The majority of the login attempts were blocked when our system detected an unusual number of failed login attempts and began captcha'ing all logins.

As a precaution, I manually enabled Cloudflare captchas for all logins instead of the usual captchas to ensure that nothing slips through the cracks. We plan to keep it enabled overnight.

At least some of the usernames attempted appear to be in the Epik breach, although that could easily be a coincidence--it's a small industry, after all. The attacker is one we've seen before, and we don't believe they have any affiliation with the Epik breach, though it's certainly possible they've added that data to their list of usernames and passwords.

The attack does not appear to have been successful. The attacker appears to have grown frustrated and attempted to register a new account when they weren't able to compromise existing accounts. The new account was flagged for review and closed.

We're still assessing the situation and trying to determine the best way to secure accounts that appear in the Epik breach. We don't have definitive plans yet.

That's bad / good that you are on top of it, Paul. Great work all-around on this.

Just to throw this out there, probably unrelated, i had some residue from the b*tc**n forum hack come back about 2-3 weeks ago. You mentioned some login activity possibly from a few weeks ago earlier in the thread, and it's plausible many members here would be members there. Just wanted to share that anecdotal piece of experience.

Best of luck containing this.

 

[tonyk2000]

NamePros observed a credential stuffing attack beginning around 7:59 PM EDT (UTC-4).

Other industry companies (registrars to begin with) will likely see the same...

 

[tonyk2000]

We're still assessing the situation and trying to determine the best way to secure accounts that appear in the Epik breach. We don't have definitive plans yet.

Forcing reset of all passwords? First, NP will not need to analyze epik dump at all. Second, it would not make any sense for the current hacker, or any other hackers (there should be many) to start another credential stuffing attack with epik db data...

 

[tonyk2000]

The password for an admin account was 123.

I posted a screen shot originally but I don't want to be accused of posting any docs.

Fascinating. If so, one would reasonably guess that Epik systems were (and, possibly, still are) controlled by different (competing) hackers, for quite some time. It is not surprising that Epik is praying. Any religous member should definitely join Rob in prayer. Who knows...

New article is up:

https://www.dailydot.com/debug/epik-ceos-live-video-response-hacking-inciden/

:
Monster also called upon Jesus to rebuke any demons that he believed could be present at the conference.

 

[TheBuyerz]

You should first block domain transfers, withdrawals, until you find the breach... you fix it on an offline version of your website and then release the limitation, after that you go after the hacker.

Members should also reset their passwords ASAP, I didn't seen the encryption used but if it's a standard one like MD5, SHA... even if Salted the attacker should have got it from the source code and everyone now.

The risk to decrypt them is high and any one can do it by generating randomly a database of passwords using the encryption and searching if any member is using it.

Reseting your passwords is a priority.

After that you update tranfer codes of domain names. (Epik will facilitate the task by blocking transfers during this period even if many members will go against this. But with all the data losses this is nothing right now).

I also think that this hack isn't a recent one and the hacker acted under the radar before it makes it public... just like happened with bitcointalk, etc.

 

[Jurgen Wolf]

https://domainnamestat.com/statistics/registrar/Epik_Inc_-IANA_ID-617

Upcoming deletes 279,329 (45.57%)